{"id":6685,"date":"2022-08-30T19:52:16","date_gmt":"2022-08-30T19:52:16","guid":{"rendered":"https:\/\/www.americanconference.com\/fcpa-dc\/?page_id=6685"},"modified":"2023-01-19T17:34:12","modified_gmt":"2023-01-19T17:34:12","slug":"harnessing-a-data-analytics-compliance-program","status":"publish","type":"page","link":"https:\/\/www.americanconference.com\/fcpa-dc\/aci-insights\/harnessing-a-data-analytics-compliance-program\/","title":{"rendered":"Harnessing a Data Analytics Compliance Program"},"content":{"rendered":"
\r\n

By Jaclyn Jaeger<\/p>\r\n

Tuesday, August 30, 2022<\/p>\r\n<\/div>\r\n\r\n

In recent years, U.S. enforcement agencies have signaled that a data-analytics<\/span> driven compliance program is more than a nice to have, it\u2019s a must-have<\/span> if companies are going to get more adept at demonstrating the effectiveness of their anti-corruption<\/span> compliance programs to regulators.<\/p>\r\n\r\n

When the U.S. Department of Justice issued its updated \u201cEvaluation of Corporate Compliance Program\u201d guidelines in June 2020, for example, it emphasized that prosecutors should evaluate whether companies have in place a data-driven<\/span> compliance program to detect potential misconduct and continuously monitor the effectiveness of their compliance programs.<\/p>\r\n\r\n

In evaluating whether a compliance program is \u201cadequately resourced and empowered,\u201d the Justice Department directs prosecutors to consider the following questions, \u201cDo compliance and control personnel have sufficient direct or indirect access to relevant sources of data to allow for timely and effective monitoring and\/or testing of policies, controls and transactions? Do any impediments exist that limit access to relevant sources of data and, if so, what is the company doing to address the impediments?\u201d<\/p>\r\n\r\n

Companies in highly regulated industries—such as financial services, pharmaceuticals and life sciences—or companies that have been subject to an enforcement action in the past are more likely to have a more mature data-driven<\/span> compliance program than those in less regulated industries or with no history of enforcement actions.<\/p>\r\n\r\n

For companies that do not fall in either of these buckets, or for small- and medium-size<\/span> enterprises that don\u2019t have massive compliance budgets, establishing a data-driven<\/span> compliance program may seem like a daunting and costly ask, but it doesn\u2019t have to be that way.<\/p>\r\n\r\n

While chief compliance officers are not data scientists, they still have an integral role to play in integrating data analytics into compliance processes and can do so by taking the following steps:<\/p>\r\n\r\n

Identify all relevant and easily accessible data sources.<\/strong> Chief compliance officers should become familiar with what relevant sources of data in the organization are easily accessible that can help in detecting risks such as fraud, waste, and abuse; sanctions risk; and third-party<\/span> risks. Easily accessible data in most companies includes accounts payable (AP) data; travel and entertainment (T&E) expenses; gifts and hospitality data; hotline data; and sales and marketing data, to name a few.<\/p>\r\n\r\n

The best use cases often reside in this readily available data. Spend is one key risk area to monitor—for example, unusually high employee-spend<\/span> associated with a certain customer account, or unusually high spend on a particular vendor. T&E expenses, like reimbursements associated with government officials, is another risk area.<\/p>\r\n\r\n

Invoices received in advance of a purchase order being created is another red flag. \u201cYou shouldn\u2019t see an invoice date before a purchase order date,\u201d said Andy Miller, chief analytics officer at Lextegrity. \u201cFurther, you shouldn\u2019t see a payment date before a purchase order date.\u201d Other red flags to watch for include duplicate spend or duplicate vendors, he said, which can signal messy processes and departments which are far more susceptible to bribery and corruption schemes.<\/p>\r\n\r\n

In addition to identifying all data necessary to detect and monitor the company\u2019s unique fraud and corruption risks, prudent chief compliance officers know the value in building partnerships and having strategic conversations with the heads of relevant business units—the end users who own the data—like finance and accounting. In a small company, those departments may also be acting in an internal audit or risk-monitoring<\/span> role.<\/p>\r\n\r\n

By talking to the finance team, chief compliance officers often walk away with a good amount of data they can start leveraging right away, said Mason Pan, director of data analytics at BDO. Such a partnership could also provide benefits from a cost standpoint, because if compliance and finance can both leverage the same data, they may also be able to share the budget, making it less of a financial ask, he said.<\/p>\r\n\r\n

Establishing a relationship with the IT department is important as well. \u201cTake your chief technology officer out to lunch,\u201d Pan said. If the company has a chief data officer, build a relationship with that individual as well.<\/p>\r\n\r\n\"Anti-Corruption<\/a>\r\n\r\n

Begin with a risk-based<\/span> approach.<\/strong> To avoid creating an over-engineered<\/span> compliance program and analyzing more data than necessary, concentrate on the highest risk areas first, based on the inherent risks of the business. \u201cIt has to be built from a risk-based<\/span> approach,\u201d Pan said.<\/p>\r\n\r\n

\u201cStart small,\u201d Pan added. \u201cStart with a proof of concept \u2026 focused on one geography or one business unit for one type of risk that you\u2019re trying to monitor,\u201d such as starting with a two- or three-year<\/span> historical lookback of data on third-party<\/span> payments made by one business unit to see if there are any potentially problematic payments being made, he said.<\/p>\r\n\r\n

Starting small also will make it easier for compliance to prove to the C-suite<\/span> and the board the return on investment when requesting to expand a data-driven<\/span> compliance program, \u201clike live monitoring or doing another historical lookback and focusing on another business unit or another type of risk,\u201d Pan said. \u201cGetting that initial scope right is really critical.\u201d<\/p>\r\n\r\n

For companies in the earliest stage of a data-driven<\/span> compliance program to help spot risks, consider turning to benchmark reports like Transparency International\u2019s annual Corruption Perceptions Index and the TRACE Bribery Risk Matrix, which risk-rank<\/span> countries by corruption risk. Those reports can help compliance officers \u201cgain insight into where you might want to start looking, where maybe the lowest hanging fruit would be,\u201d Miller said.<\/p>\r\n\r\n

Implement a data repository.<\/strong> A data-driven<\/span> compliance program demands having a tool that pulls data from all systems, databases, and parts of the business. Some companies choose to have their IT team build a data analytics system in-house<\/span> or maintain a data lake internally, where structured and unstructured data is stored.<\/p>\r\n\r\n

Companies that choose this route also typically have data scientists that then analyze the data looking for outliers and trends to identify risks. However, that still requires getting input from the chief compliance officer and forensic accountant to ensure relevant data is being pulled concerning anomalies and trends that may be indicative of things like fraud, corruption or waste and abuse.<\/p>\r\n\r\n

Many service providers today enable compliance analytics without IT having to build an on-premise<\/span> infrastructure, however. The advantage of this option from a compliance standpoint is it puts more direct control in the hands of compliance from a data analytics standpoint, rather than putting it in the hands of IT, which may not prioritize such a project in the same way compliance would, Miller said.<\/p>\r\n\r\n

\u201cData harmonization doesn\u2019t just mean getting the data into one place, it also means making the data understandable,\u201d Miller said. Lextegrity\u2019s Integrity Gateway software platform, for example, applies analytics to a company\u2019s spend and revenue transactions globally, supplemented by procurement data, approval data, and a variety of master data to monitor and detect high-risk<\/span> transactions in real-time<\/span>.<\/p>\r\n\r\n

Additionally, Lextegrity\u2019s risk library contains dozens of risk, behavioral, statistical, and policy-based<\/span> analyses that negate the need for data scientists or data engineers. End users also have the ability to drill down even deeper into the data to analyze spend by specific vendors or employees over time, or based on a specific geographic area.<\/p>\r\n\r\n

Historically, companies would have to randomly select a group of transactions to audit, but through machine-learning<\/span> and artificial intelligence capabilities today, companies can analyze all transactions in real-time<\/span>, applying a risk-scoring<\/span> algorithm. \u201cThat is a defensible approach because the methodology used to score the risk is transparent,\u201d Pan said.<\/p>\r\n\r\n

Lextegrity\u2019s transaction monitoring application, for example, risk-ranks<\/span> every transaction and provides an overall risk score, taking into consideration dozens of individual risk analytic results. Whatever solution a company uses to risk-rank<\/span> its transactions or geographic regions, that risk score indicates to compliance which areas may require enhanced due diligence, or may even be cause for an internal investigation.<\/p>\r\n\r\n

Clean the data.<\/strong> Once the data is in a centralized location, the process of cleaning the data can begin. \u201cThe cleaner the data, the less false positives you\u2019re going to get,\u201d Miller said.<\/p>\r\n\r\n

A key part of ensuring data is as clean as it can be is to ensure compliance, audit and other end users provide a continuous \u201cfeedback loop,\u201d Miller said. For example, maybe a certain key word (e.g., Spa) is creating too many false positives and needs to be tuned and refined, he said.<\/p>\r\n\r\n

\u201cDon\u2019t just create it and forget it,\u201d Pan said. \u201cWe recommend always looking at the output and giving that feedback to the model. That feedback and iterative process is another absolute critical piece to do it right.\u201d<\/p>\r\n\r\n

Demonstrate program effectiveness with data visualization.<\/strong> Data visualization essentially means making large amounts of data visually attractive through the creation of charts and graphs to make it easier for the C-suite<\/span> and the board to interpret the data and get a visual picture of where there are areas of risk or patterns of risk.<\/p>\r\n\r\n

However, a picture is worth a thousand words only if you understand the data. Starting with data visualization would be \u201clike trying to paint the Mona Lisa without having any of the foundational painting skills,\u201d Miller said.<\/p>\r\n\r\n

Act upon the data.<\/strong> No data-driven<\/span> compliance program would be truly effective if compliance, audit, and the business did not act upon what was gleaned from the analytics. This means taking any necessary remedial action, documenting those measures, and further holding culpable individuals accountable for any misconduct that is discovered.<\/p>\r\n\r\n

ACI will be holding a forum on FCPA Data Analytics at its \u201c39th<\/sup> International Conference on the FCPA,\u201d taking place Nov. 30-Dec. 1, 2022, at the Gaylord National Resort and Convention Center in Washington D.C.<\/em> | www.FCPAconference.com<\/a><\/p>\r\n\r\n

For questions, concerns or more information about ACI Insights, please contact:<\/strong>
Chris Corbin
Associate Director of Marketing
American Conference Institute |<\/span> The Canadian Institute |<\/span> C5
E: c.corbin@americanconference.com<\/a><\/p>","protected":false},"excerpt":{"rendered":"By Jaclyn Jaeger Tuesday, August 30, 2022 In recent years, U.S. enforcement agencies have signaled that a data-analytics driven compliance program is more than a nice to have, it\u2019s a must-have if companies are going to get more adept at demonstrating the effectiveness of their anti-corruption compliance programs to regulators. When the U.S. Department of…","protected":false},"author":15604,"featured_media":0,"parent":6569,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-6685","page","type-page","status-publish","hentry"],"yoast_head":"\nHarnessing a Data Analytics Compliance Program | ACI Insights | FCPA and Global Anti-Corruption<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.americanconference.com\/fcpa-dc\/aci-insights\/harnessing-a-data-analytics-compliance-program\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Harnessing a Data Analytics Compliance Program | ACI Insights | FCPA and Global Anti-Corruption\" \/>\n<meta property=\"og:description\" content=\"By Jaclyn Jaeger Tuesday, August 30, 2022 In recent years, U.S. enforcement agencies have signaled that a data-analytics driven compliance program is more than a nice to have, it\u2019s a must-have if companies are going to get more adept at demonstrating the effectiveness of their anti-corruption compliance programs to regulators. When the U.S. Department of…\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.americanconference.com\/fcpa-dc\/aci-insights\/harnessing-a-data-analytics-compliance-program\/\" \/>\n<meta property=\"og:site_name\" content=\"FCPA and Global Anti-Corruption\" \/>\n<meta property=\"article:modified_time\" content=\"2023-01-19T17:34:12+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.americanconference.com\/fcpa-dc\/wp-content\/uploads\/sites\/2080\/2026\/06\/700L_linkedin_general_1200x1200.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"1200\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.americanconference.com\/fcpa-dc\/aci-insights\/harnessing-a-data-analytics-compliance-program\/\",\"url\":\"https:\/\/www.americanconference.com\/fcpa-dc\/aci-insights\/harnessing-a-data-analytics-compliance-program\/\",\"name\":\"Harnessing a Data Analytics Compliance Program | ACI Insights | FCPA and Global Anti-Corruption\",\"isPartOf\":{\"@id\":\"https:\/\/www.americanconference.com\/fcpa-dc\/#website\"},\"datePublished\":\"2022-08-30T19:52:16+00:00\",\"dateModified\":\"2023-01-19T17:34:12+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.americanconference.com\/fcpa-dc\/aci-insights\/harnessing-a-data-analytics-compliance-program\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.americanconference.com\/fcpa-dc\/aci-insights\/harnessing-a-data-analytics-compliance-program\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.americanconference.com\/fcpa-dc\/aci-insights\/harnessing-a-data-analytics-compliance-program\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.americanconference.com\/fcpa-dc\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"ACI Insights\",\"item\":\"https:\/\/www.americanconference.com\/fcpa-dc\/aci-insights\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Harnessing a Data Analytics Compliance Program\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.americanconference.com\/fcpa-dc\/#website\",\"url\":\"https:\/\/www.americanconference.com\/fcpa-dc\/\",\"name\":\"Foreign Corrupt Practices Act\",\"description\":\"Template used to create new conference sites\",\"alternateName\":\"FCPA\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.americanconference.com\/fcpa-dc\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Harnessing a Data Analytics Compliance Program | ACI Insights | FCPA and Global Anti-Corruption","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.americanconference.com\/fcpa-dc\/aci-insights\/harnessing-a-data-analytics-compliance-program\/","og_locale":"en_US","og_type":"article","og_title":"Harnessing a Data Analytics Compliance Program | ACI Insights | FCPA and Global Anti-Corruption","og_description":"By Jaclyn Jaeger Tuesday, August 30, 2022 In recent years, U.S. enforcement agencies have signaled that a data-analytics driven compliance program is more than a nice to have, it\u2019s a must-have if companies are going to get more adept at demonstrating the effectiveness of their anti-corruption compliance programs to regulators. When the U.S. Department of…","og_url":"https:\/\/www.americanconference.com\/fcpa-dc\/aci-insights\/harnessing-a-data-analytics-compliance-program\/","og_site_name":"FCPA and Global Anti-Corruption","article_modified_time":"2023-01-19T17:34:12+00:00","og_image":[{"width":1200,"height":1200,"url":"https:\/\/www.americanconference.com\/fcpa-dc\/wp-content\/uploads\/sites\/2080\/2026\/06\/700L_linkedin_general_1200x1200.jpg","type":"image\/jpeg"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.americanconference.com\/fcpa-dc\/aci-insights\/harnessing-a-data-analytics-compliance-program\/","url":"https:\/\/www.americanconference.com\/fcpa-dc\/aci-insights\/harnessing-a-data-analytics-compliance-program\/","name":"Harnessing a Data Analytics Compliance Program | ACI Insights | FCPA and Global Anti-Corruption","isPartOf":{"@id":"https:\/\/www.americanconference.com\/fcpa-dc\/#website"},"datePublished":"2022-08-30T19:52:16+00:00","dateModified":"2023-01-19T17:34:12+00:00","breadcrumb":{"@id":"https:\/\/www.americanconference.com\/fcpa-dc\/aci-insights\/harnessing-a-data-analytics-compliance-program\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.americanconference.com\/fcpa-dc\/aci-insights\/harnessing-a-data-analytics-compliance-program\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.americanconference.com\/fcpa-dc\/aci-insights\/harnessing-a-data-analytics-compliance-program\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.americanconference.com\/fcpa-dc\/"},{"@type":"ListItem","position":2,"name":"ACI Insights","item":"https:\/\/www.americanconference.com\/fcpa-dc\/aci-insights\/"},{"@type":"ListItem","position":3,"name":"Harnessing a Data Analytics Compliance Program"}]},{"@type":"WebSite","@id":"https:\/\/www.americanconference.com\/fcpa-dc\/#website","url":"https:\/\/www.americanconference.com\/fcpa-dc\/","name":"Foreign Corrupt Practices Act","description":"Template used to create new conference sites","alternateName":"FCPA","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.americanconference.com\/fcpa-dc\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"}]}},"_links":{"self":[{"href":"https:\/\/www.americanconference.com\/fcpa-dc\/wp-json\/wp\/v2\/pages\/6685","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.americanconference.com\/fcpa-dc\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.americanconference.com\/fcpa-dc\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.americanconference.com\/fcpa-dc\/wp-json\/wp\/v2\/users\/15604"}],"replies":[{"embeddable":true,"href":"https:\/\/www.americanconference.com\/fcpa-dc\/wp-json\/wp\/v2\/comments?post=6685"}],"version-history":[{"count":0,"href":"https:\/\/www.americanconference.com\/fcpa-dc\/wp-json\/wp\/v2\/pages\/6685\/revisions"}],"up":[{"embeddable":true,"href":"https:\/\/www.americanconference.com\/fcpa-dc\/wp-json\/wp\/v2\/pages\/6569"}],"wp:attachment":[{"href":"https:\/\/www.americanconference.com\/fcpa-dc\/wp-json\/wp\/v2\/media?parent=6685"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}